POJIA破甲
地图 / Cleartext Transmission of Sensitive Information Leads to administrator access

Cleartext Transmission of Sensitive Information Leads to administrator access

密码学缺陷 / 敏感信息明文传输 / #813159

厂商
Helium
严重程度
低危
赏金
—
弱点
敏感信息明文传输
研究员
@kdr9666
披露日期
2020-05-30
资产
https://helium-console-dev.herokuapp.com/
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(1761 字符中的一小部分)
The weakness of the program is Cleartext Transmission of Sensitive Information through URL Leads to administrator access. This program is having one feature like we can add users like administrator and read-only, these are roles, into organizations. Here I get the administrator role at same …

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Helium 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @kdr9666 · 版权归作者与 Helium 所有

同类报告

Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sgUber · 2020-04-30 · $4,000Password Reset Link Leaked In Refer Header In Request To Third Party SitesNord Security · —fetlife.com/signup_step_profile expose access_token of mapbox.comFetLife · 2023-11-01Cleartext Transmission of password via EmailSheer · 2024-04-22 · $200Sensitive Info Leak - An Attacker Can Retrieve All the Users Mobile Numbers at https://website-api.production.curve.app/api/waitlist/usCurve · 2020-10-23Title: Deceptive Manipulation of HTTP to HTTPS with VPN in Burp SuitePortSwigger Web Security · 2023-10-31